Login information and Source IP!

[khurram]

how to find login information in event logs means to know that who has change the settings. Also wants to know how to check the source IP address of a session.

[BrandonS]

Organization > change log

[khurram]

not appearing in change log i already have checked that.

---

@BrandonS wrote:

Organization > change log

---

[BrandonS]

---

@khurram wrote:

not appearing in change log i already have checked that.

---

@BrandonS wrote:

Organization > change log

---

---

What is not appearing?  The user or the IP address?  The user and the changes should be there (if they were made).  The IP address is only user the user profile so you would have to use their credentials to see it.

[BrandonS]

For the source IP, I have only seen it under 'My Profile' when you click your email on the top right.  I am not sure how you could find the source IP of another user without their credentials though.

[Korey]

The Change Log would be the spot to identify changes made to the network. You could then cross reference the time and user and look at the Organization -> Login Attempts page to identify the source IP address the user logged in from.

[khurram]

someone disable the DHCP server from my MS220. In event log i have identified the time but user information is no appearing. There is no log in change log.

---

@Korey wrote:

The Change Log would be the spot to identify changes made to the network. You could then cross reference the time and user and look at the Organization -> Login Attempts page to identify the source IP address the user logged in from.

---

[Korey]

So the change shows up in the change log but without an Admin associated to that change?

[khurram]

event shows in event log not in the change log.

---

@Korey wrote:

So the change shows up in the change log but without an Admin associated to that change?

---

[Korey]

If the DHCP relay IP was changed it should be reflected in the Change Log:

If a change was made and is not showing up in the change log I would recommend reaching out to support.

[khurram]

it is not the relay agent. I have setup the DHCP server in MX65W which is connected with MS220 and users are connected with the switch too. Someone disable the DHCP server in switch->DHCP server and blocked the MX65w in there.

One thing more kindly guide me how to setup the below forma

[BrandonS]

Are you trying/Intending to run two different DHCP servers?  Why?

It sounds like maybe you saw an error in the event log about DHCP server conflict and one was shut down?

Screenshot?

[khurram]

no its a single DHCP server.

---

@BrandonS wrote:

Are you trying/Intending to run two different DHCP servers?  Why?

It sounds like maybe you saw an error in the event log about DHCP server conflict and one was shut down?

Screenshot?

---

[Korey]

Ah, I think I understand now. You are saying someone went in and blocked your MX mac address from being a DHCP server on the switch dhcp page, correct?

If so, that modification does not appear to show up in the change log but if you caught a glimpse of a change in the event log I would correlate the time with the Login Attempts to get an understanding of who was logged in at that time. 

[khurram]

yes you are correct. but the admins account are always logged in.

[Korey]

Ok, with that in mind it's tough. Reach out to your admins and ask who made a change. 

[khurram]

---

@Korey wrote:

Ok, with that in mind it's tough. Reach out to your admins and ask who made a change. 

---

No one is accepting it. Thx.

[Korey]

One last ditch, try reaching out to support to see if they can help glean some additional information related to the change that can help you correlate it to an admin.